HMACSHA1.ComputeHash()线程安全性问题 [英] HMACSHA1.ComputeHash() thread-safety question

问题描述

我要问自己，使用包含HMACSHA1实例的静态(共享)变量在asp.net页面的代码隐藏中是否有危险.问题是当在同一个asp.net页上处理多个同时请求时，所有asp.net worker-process´线程都将使用相同的HMACSHA1实例. 由所有ComputeHash()使用/修改的(HMACSHA1)instance-和ComputeHash()方法变量是否将由所有线程共享(=可以修改)?这个假设正确吗? 结果，不能保证ComputeHash的返回值是正确的?！?！ 因此，不允许我在所有asp.net线程上使用静态/共享HMACSHA1实例..

i am asking myself if it would be dangerous on a asp.net page´s codebehind to use an static (Shared) variable which holds an HMACSHA1-instance. the problem is that the same HMACSHA1-instance would be used by all the asp.net worker-process´ threads when processing multiple simultaneous requests on the same asp.net-page. all (HMACSHA1)instance- and ComputeHash()-method variables which are used/modified by ComputeHash() would be shared (= could be modified) by all the threads?! is that assumption correct? as a result the return value of ComputeHash would not be guaranteed to be correct?!?! thus i am not allowed to use an static/Shared HMACSHA1-instance over all the asp.net-threads..

我只是想知道您对这个问题的看法.

i am just wondering what you think about this problem.

对此的唯一解决方案将是诸如ComputeHash()方法中的关键路径之类的东西.但这是我们无法达到的".

the only solution to this would be sth like an critical path etc in the ComputeHash()-method. but that is "out of our reach"..

致谢， 克里斯

推荐答案

哈希算法是确定性的，它们必须每次都为给定的输入返回相同的哈希值.

Hashing algorithms are deterministic, they must return the same hash for a given input every time.

只要您每次使用相同的密钥，就无需将它们设置为静态.但是，如果要使用无参数构造函数构造HMACSHA1实例，则它将生成一个随机密钥.您应该从KeyValue属性中获取随机值，并将其与哈希一起存储.

As long as you use the same key each time then there's no need to make them static. However if you're constructing the HMACSHA1 instance with the parameterless constructor then it generates a random key. You should be taking the random value from the KeyValue property and storing it with the hash.

使用静态实例绝对危险.如果Thread1设置要计算的值，然后Thread2在Thread1调用ComputerHash()之前设置值，则Thread1将获取Thread2的值的哈希值.如果任何一个线程都在设置密钥，也会发生同样的情况.

It is definitely dangerous to use a static instance. If Thread1 sets the value to be calculated, and then Thread2 sets the value before Thread1 calls ComputerHash() then Thread1 is going to get the hash of Thread2's value. The same will happen if either thread is setting the key.

这篇关于HMACSHA1.ComputeHash()线程安全性问题的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！